|
挂钩Windows API(10) push MEMORY_BASIC_INFORMATION_SIZE push esi push edi call VirtualQuery ;内存页的信息 test eax,eax jz free_mem
call GetCurrentProcess push 5 push edi push eax call FlushInstructionCache ;只是为了确定一下:)
lea eax,[esi+014h] push eax push PAGE_EXECUTE_READWRITE lea eax,[esi+00Ch] push [eax] push [esi] call VirtualProtect ;我们要修改保护属性,这样才能够写入代码 test eax,eax jz free_mem
mov byte ptr [edi],0E9h ;写入跳转指令 mov eax,offset new_sleep sub eax,edi sub eax,5 inc edi stosd ;这里是跳转地址
|